Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs

• URL: http://arxiv.org/abs/2608.09314v1
• Date: Mon, 10 Aug 2026 08:56:50 GMT
• Title: Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs
• Abstract summary: In a federated learning setup for GANs, several adversarial attacks are possible.<n>One such attack is label flipping, in which malicious clients deliberately alter label information during local training in order to manipulate the global generator.
• Score: 8.823317238417834
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: In a federated learning setup for GANs, several adversarial attacks are possible. One such attack is label flipping, in which malicious clients deliberately alter label information during local training in order to manipulate the global generator. The objective of this attack is to skew the learned generation distribution so that samples conditioned on a target label are instead mapped to a source class. In this work, we investigate the effectiveness of label flipping attacks in federated GANs through both theoretical analysis and empirical evaluation. We further consider an oversampling based variant, in which malicious clients upweight poisoned samples during local training to amplify their influence on the aggregated global model. We quantify the resulting distributional shift by computing the Kullback Leibler divergence between the clean and poisoned class conditional distributions, and show both analytically and on FEMNIST, MNIST, and CIFAR10 that the semantic damage of the attack grows linearly in the effective poisoning strength while deviation from the true target distribution grows only quadratically, making the attack effective yet difficult to detect from label agnostic metrics.

Related papers

• Sample-wise Targeted Adversarial Attacks on Test-time Adaptation [1.7839351559374899]
  Test-time adaptation (TTA) effectively counters distribution shifts but exposes models to adversarial manipulation via the unlabeled test stream.<n>We introduce a sample-wise targeted attack to capture a more realistic threat.<n>Unlike prior approaches, the attacker aims to misclassify only inputs carrying an attacker-chosen trigger, while preserving the global label distribution of benign queries to evade detection.
  arXiv  Detail & Related papers  (2026-05-22T09:18:22Z)
• Mind the Gap: Confidence Discrepancy Can Guide Federated Semi-Supervised Learning Across Pseudo-Mismatch [50.632535091877706]
  Federated Semi-Supervised Learning (FSSL) aims to leverage unlabeled data across clients with limited labeled data to train a global model with strong generalization ability.<n>Most FSSL methods rely on consistency regularization with pseudo-labels, converting predictions from local or global models into hard pseudo-labels as supervisory signals.<n>We show that the quality of pseudo-label is largely deteriorated by data heterogeneity, an intrinsic facet of federated learning.
  arXiv  Detail & Related papers  (2025-03-17T14:41:51Z)
• Approaching the Harm of Gradient Attacks While Only Flipping Labels [2.677995462843075]
  We propose a novel formalization of label flipping attacks on logistic regression models.<n>We show that a budget of only $0.1%$ of labels at each training step can reduce the accuracy of the model by $6%$.<n>Some models can perform worse than random guessing when up to $25%$ of labels are flipped.
  arXiv  Detail & Related papers  (2025-02-28T19:35:48Z)
• Indiscriminate Disruption of Conditional Inference on Multivariate Gaussians [60.22542847840578]
  Despite advances in adversarial machine learning, inference for Gaussian models in the presence of an adversary is notably understudied. We consider a self-interested attacker who wishes to disrupt a decisionmaker's conditional inference and subsequent actions by corrupting a set of evidentiary variables. To avoid detection, the attacker also desires the attack to appear plausible wherein plausibility is determined by the density of the corrupted evidence.
  arXiv  Detail & Related papers  (2024-11-21T17:46:55Z)
• Theory-inspired Label Shift Adaptation via Aligned Distribution Mixture [21.494268411607766]
  We propose an innovative label shift framework named as Aligned Distribution Mixture (ADM) Within this framework, we enhance four typical label shift methods by introducing modifications to the classifier training process. Considering the distinctiveness of the proposed one-step approach, we develop an efficient bi-level optimization strategy.
  arXiv  Detail & Related papers  (2024-11-04T12:51:57Z)
• FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning [98.43475653490219]
  Federated learning (FL) is susceptible to poisoning attacks. FreqFed is a novel aggregation mechanism that transforms the model updates into the frequency domain. We demonstrate that FreqFed can mitigate poisoning attacks effectively with a negligible impact on the utility of the aggregated model.
  arXiv  Detail & Related papers  (2023-12-07T16:56:24Z)
• Defending against the Label-flipping Attack in Federated Learning [5.769445676575767]
  Federated learning (FL) provides autonomy and privacy by design to participating peers. The label-flipping (LF) attack is a targeted poisoning attack where the attackers poison their training data by flipping the labels of some examples. We propose a novel defense that first dynamically extracts those gradients from the peers' local updates.
  arXiv  Detail & Related papers  (2022-07-05T12:02:54Z)
• Learning and Certification under Instance-targeted Poisoning [49.55596073963654]
  We study PAC learnability and certification under instance-targeted poisoning attacks. We show that when the budget of the adversary scales sublinearly with the sample complexity, PAC learnability and certification are achievable. We empirically study the robustness of K nearest neighbour, logistic regression, multi-layer perceptron, and convolutional neural network on real data sets.
  arXiv  Detail & Related papers  (2021-05-18T17:48:15Z)
• MatchGAN: A Self-Supervised Semi-Supervised Conditional Generative Adversarial Network [51.84251358009803]
  We present a novel self-supervised learning approach for conditional generative adversarial networks (GANs) under a semi-supervised setting. We perform augmentation by randomly sampling sensible labels from the label space of the few labelled examples available. Our method surpasses the baseline with only 20% of the labelled examples used to train the baseline.
  arXiv  Detail & Related papers  (2020-06-11T17:14:55Z)
• Certified Robustness to Label-Flipping Attacks via Randomized Smoothing [105.91827623768724]
  Machine learning algorithms are susceptible to data poisoning attacks. We present a unifying view of randomized smoothing over arbitrary functions. We propose a new strategy for building classifiers that are pointwise-certifiably robust to general data poisoning attacks.
  arXiv  Detail & Related papers  (2020-02-07T21:28:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.